Introduction
Whether you’re an IT admin or developer, knowing how to programmatically access sensitivity labels ensures your SharePoint sites align with governance policies.
Microsoft Purview Sensitivity labels play a crucial role in data security and compliance in Microsoft 365, ensuring that confidential information is protected and handled according to organizational policies.
Sensitivity labels can also be applied on SharePoint sites, M365 Groups and Teams and help classify them. You can read more about these labels from the official Microsoft Docs – Use sensitivity labels with Microsoft Teams, Microsoft 365 Groups, and SharePoint sites | Microsoft Learn
However, retrieving these labels applied on SharePoint Online sites or M365 Groups can be challenging due to different APIs and authentication methods. These labels are also called as “Container Labels”.
This blog post provides a comprehensive guide on how to retrieve sensitivity label applied to SharePoint sites using multiple methods, including:
- PnP PowerShell for quick automation
- SharePoint Online Management Shell (with limitations)
- CSOM (C#) for developers
- SharePoint REST API for custom integrations
- Microsoft Graph API for M365 groups
This guide will help you find the best approach for your needs. Let’s explore how to access sensitivity labels efficiently!
1. PnP PowerShell
To use the command, Get-PnPSiteSensitivityLabel, you will have to connect to PnP PowerShell. The connection requires to register your own Entra ID application. The details can be found here.
$label = Get-PnPSiteSensitivityLabel
$label 
2. SharePoint Online Management Shell
Prerequisites
Install the SharePoint Online Management Shell.
Connect to SharePoint Admin Center.
Important Limitation
App-only authentication is not supported with SharePoint Online Management Shell. You must use an interactive user account. It only fetches the label Id and doesn’t bring back the label display name.
How It Works
Use Get-SPOSite to retrieve site details, including the
SensitivityLabelId.
3. SharePoint Client Object Model (CSOM)
ClientContext.Load(ClientContext.Site, s => s.SensitivityLabelInfo);
ClientContext.ExecuteQueryRetry();
var Id = ClientContext.Site.SensitivityLabelInfo.Id;
var DisplayName = ClientContext.Site.SensitivityLabelInfo.DisplayName;
4. SharePoint REST API
API Request
GET /_api/site/SensitivityLabelInfo HTTP/1.1 # Define Variables
$tenantId = "<$tenantId>"
$clientId = "<$clientId"
$siteUrl = "https://contoso.sharepoint.com/sites/phoenixhr"
Connect-PnpOnline $siteUrl -ClientID $clientId -Tenant contoso.onmicrosoft.com -CertificateBase64Encoded $CertBase64
$accessToken=Get-PnPAccessToken -ResourceTypeName SharePoint
# Call SharePoint REST API to Get Sensitivity Label
$apiUrl = "$siteUrl/_api/site/SensitivityLabelInfo"
$headers = @{
Authorization = "Bearer $accessToken"
Accept = "application/json"
}
$labelData = Invoke-RestMethod -Uri $apiUrl -Headers $headers -Method Get
Write-Output "Sensitivity Label ID: $($labelData.ID)"
Write-Output "Sensitivity Label Display Name: $($labelData.DisplayName)" 5. Microsoft Graph API
API Request
GET https://graph.microsoft.com/v1.0/groups/{group-id}?$select=assignedLabels 
Conclusion
Retrieving sensitivity labels in SharePoint Online can be done in multiple ways depending on your needs. Whether using PowerShell, REST API, CSOM, or Graph API, each method has its use case and limitations. Do you know any other methods to achieve this?
If you need help automating compliance and governance in Microsoft 365, reach out!!
